Including CMD_PREFIX here causes problems for any subcommand that reads
`$FLATPAK` to find the binary path, since then it's no longer actually a
binary path. Instead, we can use a wrapper script, which will then run
flatpak w/ the prefix itself.
Flatpak's progress percentage is a heuristic that includes metadata
discovery and write phases. Using it as a time base can produce
misleading remaining times or reach 00:00 while downloads are still
active.
Track the computed transfer total in FlatpakProgress. Use the remaining
bytes and measured transfer rate to calculate the CLI ETA.
COSMIC applets use these keys, and they are harmless.
X-CosmicApplet marks them as an applet for the settings app and the
panel.
X-CosmicHoverPopup marks an applet that it wants a popup on hover if a
popup is open already in another applet.
X-CosmicOverflowPriority marks the priority of an applet for overflow
behavior in the panel.
X-CosmicOverflowMinSize marks the min size of the shrinkable applet in
applet size units.
X-CosmicShrinkable marks a window as having padding that can be
shrinkable in the panel so that it takes up less space.
OCI remote checksums identify images rather than imported OSTree commits.
Compare against the deployed alternative ID as well, matching the update
transaction's identity check and avoiding false pending updates.
Test OCI update listings after install, after publishing a real update,
and after applying it, using the existing user/system HTTP/HTTPS tests.
Uncrustify renamed align_number_left to align_number_right in
https://github.com/uncrustify/uncrustify/pull/1393.
Remove sp_balance_nested_parens, which Uncrustify reports as replaced by
sp_paren_paren.
gpgme_ctx_t was not wrapped with g_auto(), so gpgme_new() allocated
contexts were never released by gpgme_release() on any return path.
All other GPGME types in the same function already use g_auto().
Github's ubuntu-latest is currently 24.04, and the bubblewrap in
Ubuntu 24.04 doesn't have everything that we need.
Signed-off-by: Simon McVittie <smcv@collabora.com>
flatpak_allocate_tmpdir created child repo directories (repo- and
child-oci-) with mode 0777, allowing any local user to modify their
contents between the client pull and the system helper deploy.
Use 0755 instead, which prevents other users from writing while
still allowing the revokefs-fuse frontend to read the backing store
directly. The frontend runs as the calling user while the writer
backend runs as the flatpak system user, so the frontend needs
read access to directories created by the backend. Mode 0700 would
break this.
Resolves: CVE-2026-97026
Resolves: https://github.com/flatpak/flatpak/security/advisories/GHSA-r9w3-qx54-qvc8
The .token file was written into the child-oci directory so the
system helper could read it back for remote registry verification.
However, the system helper only ever opens the child-oci registry
as a local source (dfd != -1), and every code path that uses
self->token for HTTP requests is gated behind dfd == -1. The token
was never reachable since it was introduced in commit 5d8fd2d1b.
Persisting credentials to a world-traversable directory in /var/tmp
is a security risk on multi-user systems. Remove the file write
from set_token and the file read from ensure_local. The token
remains available in memory for the client process that actually
needs it for remote access.
Resolves: CVE-2026-97025
Resolves: https://github.com/flatpak/flatpak/security/advisories/GHSA-7rvf-rqr3-43j4
The runtime files directory was opened with open() using O_PATH but
without symlink protection, unlike the app files path which used
O_NOFOLLOW. Since "files" is validated as a non-symlink during deploy,
this is not exploitable through normal install flow. However, the open
should still use safe fd-relative operations as defense-in-depth.
Use flatpak_deploy_get_files_fd which validates the path with
glnx_chaseat(GLNX_CHASE_RESOLVE_NO_SYMLINKS), rejecting any symlink
at the directory boundary.
Hardening related to CVE-2026-97023, CVE-2026-97024
Helps: https://github.com/flatpak/flatpak/security/advisories/GHSA-5p67-xh8x-rq54
Helps: https://github.com/flatpak/flatpak/security/advisories/GHSA-8xgq-v545-vgvf
dir_is_locked() used g_file_resolve_relative_path to construct the
path to files/.ref, then open() without O_NOFOLLOW. Since "files" is
validated as a non-symlink during deploy and ".ref" is atomically
created as a regular file, this is not exploitable through normal
install flow. However, the function should still use safe fd-relative
operations as defense-in-depth.
Rename dir_is_locked to deploy_dir_is_locked to reflect that it
operates specifically on deploy directories, not arbitrary ones.
Hardening related to CVE-2026-97023, CVE-2026-97024
Helps: https://github.com/flatpak/flatpak/security/advisories/GHSA-5p67-xh8x-rq54
Helps: https://github.com/flatpak/flatpak/security/advisories/GHSA-8xgq-v545-vgvf
The runtime deploy path used GFile operations to manipulate files
inside files/etc (passwd, group, machine-id, resolv.conf). While
the "files" directory is validated with glnx_chaseat using
GLNX_CHASE_RESOLVE_NO_SYMLINKS, "etc" inside it is not checked.
A malicious runtime with files/etc as a symlink causes the GFile
operations (g_file_delete, g_file_replace_contents,
g_file_make_symbolic_link) to follow it and modify files at the
symlink target. On system installs (running as root), this modifies
arbitrary files — e.g. replacing /etc/resolv.conf.
This commit uses fd-based operations to prevent to prevent the symlink
attack.
Resolves: CVE-2026-97024
Resolves: https://github.com/flatpak/flatpak/security/advisories/GHSA-8xgq-v545-vgvf
The export directory cleanup during deploy used flatpak_rm_rf which
wraps glnx_shutil_rm_rf_at(AT_FDCWD, path). The kernel resolves
intermediate symlinks in the path, so a malicious ostree commit with
"export" as a symlink causes flatpak_rm_rf(export/bin) to delete files
at the symlink target. On system installs (running as root), this is
arbitrary file deletion.
This commit uses fd-based operations to prevent to prevent the symlink
attack.
Resolves: CVE-2026-97023
Resolves: https://github.com/flatpak/flatpak/security/advisories/GHSA-5p67-xh8x-rq54
Add deploy_open_fd, flatpak_deploy_get_files_fd,
flatpak_deploy_get_export_fd, and flatpak_deploy_get_metadata_fd which
open files within a deploy directory using fd-relative operations with
symlink protection.
deploy_open_fd uses a two-step resolution:
GLNX_CHASE_RESOLVE_NO_SYMLINKS at the directory boundary (files/,
export/) to reject symlinks, then GLNX_CHASE_RESOLVE_BENEATH within the
directory to safely resolve symlinks relative to the directory root.
These will be used by subsequent commits to close TOCTOU gaps where
GFile path operations were used after fd-based validation.
Prerequsite for fixing CVE-2026-97023, CVE-2026-97024
Helps: https://github.com/flatpak/flatpak/security/advisories/GHSA-5p67-xh8x-rq54
Helps: https://github.com/flatpak/flatpak/security/advisories/GHSA-8xgq-v545-vgvf
This prevents sandboxed processes from being able to kill processes
outside the sandbox with `kill (0, SIGNAL)`. The only process they can
kill like this will be the `bwrap` supervisor, which just terminates
the sandbox when killed.
Resolves: CVE-2026-97029
Resolves: https://github.com/flatpak/flatpak/security/advisories/GHSA-f3p8-vr7v-gxf2
Signed-off-by: Simon McVittie <smcv@collabora.com>
Describe the default var/tmp directory and var/run symlink created by
build-init. Document that build persists var/lib and var/tmp instead of
mounting the entire var directory.
Exercise existing files, directories and nonexistent files against a real
document portal on the private test bus. Verify that --noexist returns a
usable export after the origin is created and preserves its read grant.
The regression fails on the AddNamed reply type mismatch without the fix.
All four checks pass with it.
With --noexist, the opened file descriptor refers to the parent directory.
The request correctly uses AddNamed, but is_directory makes the reply
parser expect AddFull's array reply instead of AddNamed's single string.
This produces a GVariant type mismatch and crashes the command.
Only select the AddFull reply parser for directory exports without
--noexist, matching the method used for the request.
The document portal is mounted at /run/flatpak/doc inside the sandbox,
but forwarded arguments used its host mount path. With a nonstandard
host runtime directory, that path is inaccessible to the application.
Keep the host path local to mount setup and return the sandbox destination
to argument forwarding. Preserve NULL when the portal is unavailable.
Add real-portal regression tests for user and isolated system installs.
Check file read/write, escaped URIs, directories and passthrough controls.
Skip the directory subtest on portal interfaces older than version 4.
Applications using libflatpak currently have to duplicate the CLI's
private cleanup logic to offer the equivalent of uninstall --delete-data.
Add a standalone API that removes ~/.var/app data and resets permission
store entries without requiring the app to be installed. Keep it separate
from transactions so callers can retry partial failures or reset data for
an installed app.
Validate app IDs before constructing paths, propagate cancellation and
permission table errors, and document partial failure behavior.
Permission table discovery reads the on-disk database directory and does
not use the D-Bus permission store proxy. Remove the unused argument and
update callers.
Return the permission reset result directly after app data removal. This
keeps the success and error paths equivalent while removing an unnecessary
conditional.
Libflatpak needs to reuse user-data deletion and permission reset logic
that was previously private to the command-line builtins. This will let
software stores offer the equivalent of uninstall --delete-data.
Move each concern into a separate common module without changing behavior
so a public API can be added in a later commit. Name the user-data module
and its helper consistently here, and keep them distinct from the
existing appdata metadata code.
flatpak update --commit and flatpak remote-info read the download size
from xa.download-size in the commit metadata, which only covers the
ostree file objects and not extra-data. The summary cache path used by
a regular flatpak update does add extra-data sizes, so the two differed:
extra-data apps like com.jetbrains.Rider showed 1.3 MB instead of 1.6 GB.
Add flatpak_commit_add_extra_data_sizes() to sum the extra-data sizes
from a commit variant, and use it in resolve_op_from_commit() and
remote-info so they match the summary path. The existing
flatpak_repo_collect_extra_data_sizes() is changed to reuse it.
Fixes: https://github.com/flatpak/flatpak/issues/5947
In flatpak_table_printer_append_cell_with_comma_unique, the duplicate
check only verified the right boundary (match[len] == 0 or comma).
This caused false positives: searching for "all" in "superall" matched
because the character after "all" happened to be a comma, even though
"all" was a substring of "superall", not a separate comma-delimited
entry.
Calculate the position of each match via pointer arithmetic
(match - cell->text) and use cell->text[pos - 1] to check the left
boundary, so that a match is only treated as duplicate when it is at
the start of the cell or preceded by a comma.
The variables d, m, y are declared as 'int', but the format string
used '%u' which expects 'unsigned int *'. Change to '%d' to match
the actual argument type.
Detected by GCC -Wformat when building with warning_level=3.
flatpak remote-info and remote-ls --updates load version information
from a locally cached AppStream XML file that only gets refreshed during
'flatpak update'. This causes remote-info to show stale version numbers
when a new version has been published.
Fix this by calling update_appstream() before loading cached AppStream
data, unless --cached is specified. Use FLATPAK_APPSTREAM_TTL (1 day)
to avoid re-downloading on every invocation.
Closes: #5974
Signed-off-by: liweinan <liweinan@kylinos.cn>
remote-add registers --no-follow_redirect instead of the documented
--no-follow-redirect. Its reversed flag and both remote-modify redirect
flags set initially false booleans to false, so the policy is not applied.
Correct the option spelling and remove G_OPTION_FLAG_REVERSE so these
switches enable the corresponding configuration updates.
The LOCATION arg's choice attribute value was "plan>" instead of
"plain" — a stray ">" was glued onto the value, breaking the DocBook
XML element. The same arg on the line above already used "plain"
correctly; this makes the two occurrences consistent.
re:fi.64